Free plan Signups are open now. The full audytx engine — Terraform and CloudFormation — is live. The Free plan is 100 scans a month and stays free — paid tiers arrive Nov 01, 2026 from $20/month for unlimited repositories. Try it on your own code.

IAM inline policy attached to a role — should use managed policy

AWS_OPS_044 LOW Security

What it checks

Inline policy belongs to a single IAM role and cannot be reused independently.

Where it applies

Terraform: aws_iam_role_policy

CloudFormation: no CloudFormation type maps to these resources yet.

How to fix it

  1. Decide whether reusable managed ownership is beneficial. Inline role policies can be validated by IAM Access Analyzer. For conversion, respect the 6,144-character managed-policy limit (whitespace excluded) and managed-policy attachment quotas; large inline policies may need merging or splitting.
  2. Create the managed document, attach it to the existing role, verify effective permissions and only then remove the inline policy. Keep the inline policy until verification succeeds. API role deletion requires deleting inline policies and detaching managed policies; console workflows can do that cleanup.

Vendor documentation

All rules